657201 - (CVE-2011-2368) WebGL crash [@createProgram/@gldCopyTexSubImage]

Status: RESOLVED FIXED

(Core :: Graphics: CanvasWebGL, defect)

Description

[Christoph Diehl [:posidron]]

Attachment: testcase

Sometimes it crashes in createProgram, sometimes in gldCopyTexSubImage.

The bug is currently only reproducible against:

ProductName:	Mac OS X
ProductVersion:	10.6.7
BuildVersion:	10J869
OpenGL renderer string: ATI Radeon HD 6750M OpenGL Engine
OpenGL version string: 2.1 ATI-1.6.32

I have marked this as a security issue because I get some write violations at different places.

Comment 1

[Christoph Diehl [:posidron]]

Attachment: callstack1-read-0

Comment 2

[Christoph Diehl [:posidron]]

Attachment: callstack2-write-0

Comment 3

[Christoph Diehl [:posidron]]

Attachment: callstack3-write-value.txt

Comment 4

[Benoit Jacob [:bjacob] (mostly away)]

Oh oh, really interesting! All 3 crashes have in common to be happening inside of glValidateProgram(). In bug 593867, we already decided to avoid calling glValidateProgram on Macs with NVIDIA cards. Now you're getting problems with a ATI card --> let's completely avoid glValidateProgram() which means that it wasn't NVIDIA specific.

Comment 5

[Benoit Jacob [:bjacob] (mostly away)]

Chris, I had filed Apple bug 9129482, but it got closed as "missing information". It seems that this bug could use some pushing by an Apple insider ;-)

Comment 6

[Benoit Jacob [:bjacob] (mostly away)]

Attachment: really disable validateProgram() on Mac

Comment 7

[Benoit Jacob [:bjacob] (mostly away)]

Note: it's also very interesting to have this on Mac OS 10.6.7. My Apple bug got closed as I was unable to confirm whether it still happened on 10.6.7.

Comment 8

[Christoph Diehl [:posidron]]

Fixed - thanks Benoit.

Comment 9

[Benoit Jacob [:bjacob] (mostly away)]

We should keep this bug open until it's actually fixed in the tree! Please review my patch or tell me if you would like me to find someone else.

Comment 10

[Christoph Diehl [:posidron]]

Oh. Sorry for closing it to early.

I already reviewed your patch, applied it to my build and checked it against the provided testcase. ;)

Comment 11

[Benoit Jacob [:bjacob] (mostly away)]

Welcome to Mozilla bureaucracy: if you approve my patch, please click 'Details', then on the 'review' line, select '+'.

Then we will land it, paste here a link to the changeset, and finally close this bug.

Comment 12

[Asa Dotzler [:asa]]

Comment on attachment 532643 [details] [diff] [review]
really disable validateProgram() on Mac

Please land this change on both Aurora and Beta. (In the future, getting changes in during Aurora will save you this extra step.)

Comment 13

[Benoit Jacob [:bjacob] (mostly away)]

mozilla-central:
http://hg.mozilla.org/mozilla-central/rev/9ca849387799

I didn't realize that this was now sg-critical, sorry. Will land on aurora and beta ASAP.

Comment 14

[Benoit Jacob [:bjacob] (mostly away)]

Pushed to Beta:
http://hg.mozilla.org/releases/mozilla-beta/rev/eba2dce26189

The fix was already on Aurora, as the Central->Aurora merge happened since I landed on Central.

Comment 15

[Jukka Jylänki]

The workaround that was added in this issue is about 5 years old now. Marked down bug 1284425 to discuss if the workaround is relevant any more on recent OS X versions.